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GROUP, H 2 , GENERATE ALL THE 
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for each role r in the role-group assigned to Hi : 

for each statement in the form: { r $ R : s} 

/* where r is a role, $ indicates the direction, R is a role- 
group and s is a service */ 
if H2 is closed: /* create a rule if H2 has a role, r */ 

if the role-group assigned to H2 contains a role in R, 
then 

create a positive rule between Hi and H2 with 
service=s 

otherwise, for all host-groups G that contain H 2 : 

if the role-group assigned to G contains a role in R 

create positive rule between Hi and H 2 with 
servicers 
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Replicate the centralized configuration file to every gateway 
interface 

for each gateway interface 

for each rule in the configuration file 
if the source is in the adjacent zone 

set direction to OUT 
else if the destination is in the adjacent zone 

set direction to IN 
else set direction to BOTH 
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